Apologies for the late response. However, if this is still something you're interested in I am in the process of developing a use case for RSA NetWitness within ICS/SCADA environments. My goal is to document the use case and also provide a few potentially useful parsers.

These parsers will focus on common protocols (such as S7) that are observed within ICS/SCADA environments. If you have any specifics regarding your environment that you can share, I'll try to include some specific information to that regards.